Modern Approach to Attributing Hacktivist Groups

This research examines state-aligned hacktivist personas by combining topic modeling (BERTopic) and stylometric analysis to attribute groups and uncover coordination. Analyzing ~20,000 Telegram and X messages from 35 accounts, it identifies thematic focuses tied to geopolitical events (e.g., Ukraine and Israel-Hamas) and stylistic overlaps suggesting shared operators (including clusters consistent with APT44-linked personas). The study highlights shifts in authorship, coordinated campaigns, and the value of linguistic fingerprints for attribution, while noting data and model limitations and recommending continuous, automated monitoring and expanded multimodal analysis.